PingCastle 3.0.0.0

Author: vletoux

Healthcheck/Rules/HeatlcheckRuleAnomalyHardenedPaths.cs

@@ -14,37 +14,77 @@ namespace PingCastle.Healthcheck.Rules
     [RuleSTIG("V-63577", "Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\\\*\\SYSVOL and \\\\*\\NETLOGON shares.", STIGFramework.Windows10)]
     [RuleMaturityLevel(2)]
     [RuleMitreAttackTechnique(MitreAttackTechnique.ManintheMiddleLLMNRNBTNSPoisoningandSMBRelay)]
-    [RuleIntroducedIn(2,10,1)]
+    [RuleIntroducedIn(2, 10, 1)]
     public class HeatlcheckRuleAnomalyHardenedPaths : RuleBase<HealthcheckData>
     {
         protected override int? AnalyzeDataNew(HealthcheckData healthcheckData)
         {
             if (healthcheckData.GPOHardenedPath == null)
                 return null;
+            bool netlogon = false;
+            bool sysvol = false;
             foreach (var policy in healthcheckData.GPOHardenedPath)
             {
-                if (policy.RequireIntegrity == false || policy.RequireMutualAuthentication == false)
+                if (string.IsNullOrEmpty(policy.GPOId))
                 {
-                    bool anomaly = false;
-                    if (policy.Key.IndexOf("SYSVOL", StringComparison.OrdinalIgnoreCase) > 0 || policy.Key.IndexOf("NETLOGON", StringComparison.OrdinalIgnoreCase) > 0)
+                    continue;
+                }
+                if (healthcheckData.GPOInfoDic == null || !healthcheckData.GPOInfoDic.ContainsKey(policy.GPOId))
+                {
+                    continue;
+                }
+                var refGPO = healthcheckData.GPOInfoDic[policy.GPOId];
+                if (refGPO.IsDisabled)
+                {
+                    continue;
+                }
+                if (refGPO.AppliedTo == null || refGPO.AppliedTo.Count == 0)
+                {
+                    continue;
+                }
+
+                bool anomaly = false;
+                if (policy.Key.IndexOf("SYSVOL", StringComparison.OrdinalIgnoreCase) > 0)
+                {
+                    sysvol = true;
+                    if (policy.RequireIntegrity == false || policy.RequireMutualAuthentication == false)
+                    {
+                        anomaly = true;
+                    }
+                }
+                else if (policy.Key.IndexOf("NETLOGON", StringComparison.OrdinalIgnoreCase) > 0)
+                {
+                    netlogon = true;
+                    if (policy.RequireIntegrity == false || policy.RequireMutualAuthentication == false)
                     {
                         anomaly = true;
                     }
-                    else
+                }
+                else
+                {
+                    foreach (var dc in healthcheckData.DomainControllers)
                     {
-                        foreach (var dc in healthcheckData.DomainControllers)
+                        if (policy.Key.StartsWith("\\\\" + dc.DCName + "\\", StringComparison.OrdinalIgnoreCase) && policy.Key.Contains("*"))
                         {
-                            if (policy.Key.StartsWith("\\\\" + dc.DCName + "\\", StringComparison.OrdinalIgnoreCase) && policy.Key.Contains("*"))
+                            if (policy.RequireIntegrity == false || policy.RequireMutualAuthentication == false)
                             {
                                 anomaly = true;
                             }
                         }
                     }
-                    if (anomaly)
-                    {
-                        AddRawDetail(policy.GPOName, policy.Key, GetString(policy.RequireIntegrity), GetString(policy.RequireMutualAuthentication), GetString(policy.RequirePrivacy));
-                    }
                 }
+                if (anomaly)
+                {
+                    AddRawDetail(policy.GPOName, policy.Key, GetString(policy.RequireIntegrity), GetString(policy.RequireMutualAuthentication), GetString(policy.RequirePrivacy));
+                }
+            }
+            if (!netlogon)
+            {
+                AddRawDetail("No GPO Found", "NETLOGON", "Not Set", "Not Set", "Not Set");
+            }
+            if (!sysvol)
+            {
+                AddRawDetail("No GPO Found", "SYSVOL", "Not Set", "Not Set", "Not Set");
             }
             return null;
         }